Commit bcb6665
authored
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
Bump the dependabot group with 6 updates (google#516)
Bumps the dependabot group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2026.2.25` |
`2026.4.22` |
| [cryptography](https://github.com/pyca/cryptography) | `46.0.7` |
`47.0.0` |
| [idna](https://github.com/kjd/idna) | `3.11` | `3.13` |
| [packaging](https://github.com/pypa/packaging) | `26.1` | `26.2` |
| [pip](https://github.com/pypa/pip) | `26.0` | `26.1` |
| [wheel](https://github.com/pypa/wheel) | `0.46.2` | `0.47.0` |
Updates `certifi` from 2026.2.25 to 2026.4.22
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/5dddfb072243da27adde885b73ba9b809c3224ca"><code>5dddfb0</code></a>
2026.04.22 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/410">#410</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/f99eccdaf87f7c10e521a58a700ca3eb94a0787e"><code>f99eccd</code></a>
Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/404">#404</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/918bed055f7291719512af186c1c24710f845660"><code>918bed0</code></a>
Bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/405">#405</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/0a49067eb434e53e1f8df5f7707d5dc05ef9def4"><code>0a49067</code></a>
Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/403">#403</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/acf6ce8e39e3b125f4349e11904295e4fe4c1bed"><code>acf6ce8</code></a>
Bump actions/download-artifact from 8.0.0 to 8.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/398">#398</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/feb0ed26163a9417ea0fb8eb52d47e79fcf202ab"><code>feb0ed2</code></a>
Bump actions/download-artifact from 7.0.0 to 8.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/397">#397</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/d9c11a50369cc377abb40f7909ded3d6da4d98a3"><code>d9c11a5</code></a>
Bump actions/upload-artifact from 6.0.0 to 7.0.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/396">#396</a>)</li>
<li>See full diff in <a
href="https://github.com/certifi/python-certifi/compare/2026.02.25...2026.04.22">compare
view</a></li>
</ul>
</details>
<br />
Updates `cryptography` from 46.0.7 to 47.0.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's
changelog</a>.</em></p>
<blockquote>
<p>47.0.0 - 2026-04-24</p>
<pre><code>
* Support for Python 3.8 is deprecated and will be removed in the next
``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
(``SECT*`` classes) has been removed. These curves are rarely used and
have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been
removed.
OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms
or
keys with unsupported explicit curve encodings now raises
:class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
``ValueError``. This change affects
:func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
:func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
:func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
:func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
and :meth:`~cryptography.x509.Certificate.public_key` when called on
certificates with unsupported public key algorithms.
* **BACKWARDS INCOMPATIBLE:** When parsing elliptic curve private keys,
we now
reject keys that incorrectly encode a private key of the wrong length
because
such keys are impossible to process in a constant-time manner. We do not
believe keys with this problem are in wide use, however we may revert
this
change based on the feedback we receive.
* Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys to
:class:`~cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES`. In
a
future release, only 192-bit (24-byte) keys will be accepted. Users
should
expand shorter keys themselves (e.g., for single DES: ``key + key +
key``,
for two-key: ``key + key[:8]``).
* Updated the minimum supported Rust version (MSRV) to 1.83.0, from
1.74.0.
* Support for ``x86_64`` macOS (including publishing wheels) is
deprecated
and will be removed in the next release. We will switch to publishing an
``arm64`` only wheel for macOS.
* Support for 32-bit Windows (including publishing wheels) is deprecated
and will be removed in the next release. Users should move to a 64-bit
Python installation.
* ``public_bytes`` and ``private_bytes`` methods on keys now raise
``TypeError`` (instead of ``ValueError``) if an invalid encoding is
provided
for the given ``format``.
* Moved :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
:class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
:class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8` into
:doc:`/hazmat/decrepit/index` and deprecated them in the ``modes``
module.
They will be removed from the ``modes`` module in 49.0.0.
* Moved
:class:`~cryptography.hazmat.primitives.ciphers.algorithms.Camellia`
into :doc:`/hazmat/decrepit/index` and deprecated it in the ``cipher``
module.
It will be removed from the ``cipher`` module in 49.0.0.
</tr></table>
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pyca/cryptography/commit/59c5f5e4b9395f32d407f66467d59ccea9f9829f"><code>59c5f5e</code></a>
bump for 47.0.0 release (<a
href="https://redirect.github.com/pyca/cryptography/issues/14730">#14730</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/9025578c87f14096f9332264881f5370a1c64e93"><code>9025578</code></a>
Add MLKEM1024-P384 hybrid KEM support in HPKE (<a
href="https://redirect.github.com/pyca/cryptography/issues/14722">#14722</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/ef66de49e0bd281da86750178ab2fb4b5b104162"><code>ef66de4</code></a>
Recommend Argon2id over PBKDF2HMAC as KDF (<a
href="https://redirect.github.com/pyca/cryptography/issues/14724">#14724</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/d996a37666524c606419e71de15eb527bae655aa"><code>d996a37</code></a>
Add ubuntu-resolute to CI workflow (<a
href="https://redirect.github.com/pyca/cryptography/issues/14729">#14729</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/e86da41ff7e21a04529a933856dc27dacd9e7fc0"><code>e86da41</code></a>
chore(deps): bump libc from 0.2.185 to 0.2.186 (<a
href="https://redirect.github.com/pyca/cryptography/issues/14725">#14725</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/1c33c9a5d96a7b1a975ab5a465a75517e0ebadd6"><code>1c33c9a</code></a>
Bump downstream dependencies in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/14728">#14728</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/67fb6be685bbc0952a47cf18e9ee4533b411cd8b"><code>67fb6be</code></a>
Bump x509-limbo and/or wycheproof in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/14727">#14727</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/6cb20b3141c6391ae11075f30b992375c05adad5"><code>6cb20b3</code></a>
Bump BoringSSL, OpenSSL, AWS-LC in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/14726">#14726</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/d6f372d7ea7f7df96aeda240252a23b6ed46bc71"><code>d6f372d</code></a>
Update supported OpenSSL versions in installation docs (<a
href="https://redirect.github.com/pyca/cryptography/issues/14721">#14721</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/ebd26194cd6a3315b122a44d2ee5aeb138bee55b"><code>ebd2619</code></a>
openssl 3.3 is out of upstream support (<a
href="https://redirect.github.com/pyca/cryptography/issues/14720">#14720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pyca/cryptography/compare/46.0.7...47.0.0">compare
view</a></li>
</ul>
</details>
<br />
Updates `idna` from 3.11 to 3.13
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/blob/master/HISTORY.rst">idna's
changelog</a>.</em></p>
<blockquote>
<p>3.13 (2026-04-22)
+++++++++++++++++</p>
<ul>
<li>Correct classification error for codepoint U+A7F1</li>
</ul>
<p>3.12 (2026-04-21)
+++++++++++++++++</p>
<ul>
<li>Update to Unicode 17.0.0.</li>
<li>Issue a deprecation warning for the transitional argument.</li>
<li>Added lazy-loading to provide some performance improvements.</li>
<li>Removed vestiges of code related to Python 2 support, including
segmentation of data structures specific to Jython.</li>
</ul>
<p>Thanks to Rodrigo Nogueira for contributions to this release.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kjd/idna/commit/89cdfd27338896cee6b1ee18e64c96ac28684ce0"><code>89cdfd2</code></a>
Release v3.13</li>
<li><a
href="https://github.com/kjd/idna/commit/1eb068687543118147417a8d8a70674e2c172891"><code>1eb0686</code></a>
Pre-release 3.13</li>
<li><a
href="https://github.com/kjd/idna/commit/5f20d1e41eea3b3873d18d83d7a384784f72a92e"><code>5f20d1e</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/220">#220</a> from
kjd/unicode-next</li>
<li><a
href="https://github.com/kjd/idna/commit/4ea84252ab21e62a79e5a3273746112b5dcfb810"><code>4ea8425</code></a>
Regenerate idnadata.py with correct NFKC_CF data</li>
<li><a
href="https://github.com/kjd/idna/commit/fd47341a08bbdcffda33694211ca4de10170cd41"><code>fd47341</code></a>
Use NFKC_CF from Unicode data files instead of Python's unicodedata
module</li>
<li><a
href="https://github.com/kjd/idna/commit/a5304a4cdbd7b31595f8ac42ffdfa88f5b936467"><code>a5304a4</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/219">#219</a> from
kjd/release-3.12</li>
<li><a
href="https://github.com/kjd/idna/commit/d80d6f9254d699961fa2c669a1534cde9d4ee5b6"><code>d80d6f9</code></a>
Release v3.12</li>
<li><a
href="https://github.com/kjd/idna/commit/1bb44ddb3f2a9dcf97a6ac11aba34e5b6ed31291"><code>1bb44dd</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/218">#218</a> from
kjd/release-candidate-3.12rc0</li>
<li><a
href="https://github.com/kjd/idna/commit/909c49d15b8d159be163bccc7972116baffdb47b"><code>909c49d</code></a>
Release candidate for 3.12</li>
<li><a
href="https://github.com/kjd/idna/commit/c5459a10370f005dc09921aee3201b5a45699f9d"><code>c5459a1</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/217">#217</a> from
kjd/housekeeping-2</li>
<li>Additional commits viewable in <a
href="https://github.com/kjd/idna/compare/v3.11...v3.13">compare
view</a></li>
</ul>
</details>
<br />
Updates `packaging` from 26.1 to 26.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/packaging/releases">packaging's
releases</a>.</em></p>
<blockquote>
<h2>26.2</h2>
<h2>What's Changed</h2>
<p>Fixes:</p>
<ul>
<li>Fix incorrect sysconfig var name for pyemscripten by <a
href="https://github.com/ryanking13"><code>@ryanking13</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1160">pypa/packaging#1160</a></li>
<li>Make <code>Version</code>, <code>Specifier</code>,
<code>SpecifierSet</code>, <code>Tag</code>, <code>Marker</code>, and
<code>Requirement</code> pickle-safe
and backward-compatible with pickles created in 25.0-26.1 (including
references to the removed
<code>packaging._structures</code> module) by <a
href="https://github.com/eachimei"><code>@eachimei</code></a> and <a
href="https://github.com/henryiii"><code>@henryiii</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1163">pypa/packaging#1163</a>,
<a
href="https://redirect.github.com/pypa/packaging/pull/1168">pypa/packaging#1168</a>,
<a
href="https://redirect.github.com/pypa/packaging/pull/1170">pypa/packaging#1170</a>,
and <a
href="https://redirect.github.com/pypa/packaging/pull/1171">pypa/packaging#1171</a></li>
<li>fix: re-export ExceptionGroup for now by <a
href="https://github.com/henryiii"><code>@henryiii</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1164">pypa/packaging#1164</a></li>
</ul>
<p>Documentation:</p>
<ul>
<li>docs: add errors section and fix missing details by <a
href="https://github.com/henryiii"><code>@henryiii</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1159">pypa/packaging#1159</a></li>
<li>docs(dev): document property-based test suite by <a
href="https://github.com/r266-tech"><code>@r266-tech</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1167">pypa/packaging#1167</a></li>
<li>Fix typo in DirectUrl documentation by <a
href="https://github.com/sbidoul"><code>@sbidoul</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1169">pypa/packaging#1169</a></li>
<li>docs(specifiers): add is_unsatisfiable() usage example by <a
href="https://github.com/r266-tech"><code>@r266-tech</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1166">pypa/packaging#1166</a></li>
</ul>
<p>Internal:</p>
<ul>
<li>Enable the auditor persona on zizmor by <a
href="https://github.com/henryiii"><code>@henryiii</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1158">pypa/packaging#1158</a></li>
<li>Test new pickle guarantees by <a
href="https://github.com/henryiii"><code>@henryiii</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1174">pypa/packaging#1174</a></li>
<li>Use native uv integration in rtd by <a
href="https://github.com/henryiii"><code>@henryiii</code></a> in <a
href="https://redirect.github.com/pypa/packaging/pull/1175">pypa/packaging#1175</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/ryanking13"><code>@ryanking13</code></a> made
their first contribution in <a
href="https://redirect.github.com/pypa/packaging/pull/1160">pypa/packaging#1160</a></li>
<li><a href="https://github.com/eachimei"><code>@eachimei</code></a>
made their first contribution in <a
href="https://redirect.github.com/pypa/packaging/pull/1163">pypa/packaging#1163</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/packaging/compare/26.1...26.2">https://github.com/pypa/packaging/compare/26.1...26.2</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/packaging/blob/main/CHANGELOG.rst">packaging's
changelog</a>.</em></p>
<blockquote>
<p>26.2 - 2026-04-24</p>
<pre><code>
Fixes:
<ul>
<li>Fix incorrect sysconfig var name for pyemscripten in
(:pull:<code>1160</code>)</li>
<li>Make <code>Version</code>, <code>Specifier</code>,
<code>SpecifierSet</code>, <code>Tag</code>, <code>Marker</code>, and
<code>Requirement</code> pickle-safe<br />
and backward-compatible with pickles created in 25.0-26.1 (including
references to the removed<br />
<code>packaging._structures</code> module) (:pull:<code>1163</code>,
:pull:<code>1168</code>, :pull:<code>1170</code>,
:pull:<code>1171</code>)</li>
<li>Re-export <code>ExceptionGroup</code> in metadata for now in
(:pull:<code>1164</code>)</li>
</ul>
<p>Documentation:</p>
<ul>
<li>Add errors section and fix missing details in
(:pull:<code>1159</code>)</li>
<li>Document our property-based test suite in
(:pull:<code>1167</code>)</li>
<li>Fix a <code>DirectUrl</code> typo in (:pull:<code>1167</code>)</li>
<li>Add example of <code>is_unsatisfiable</code> in
(:pull:<code>1166</code>)</li>
</ul>
<p>Internal:</p>
<ul>
<li>Enable the auditor persona on zizmor in
(:pull:<code>1158</code>)</li>
<li>Test new pickle guarantees in (:pull:<code>1174</code>)</li>
<li>Use new native ReadTheDocs uv integration in
(:pull:<code>1175</code>)<br />
</code></pre></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/packaging/commit/84a87ee42483d7352f9502d78a9553da8859aa7a"><code>84a87ee</code></a>
Bump for release</li>
<li><a
href="https://github.com/pypa/packaging/commit/4a616b65bed23c8c6d58e6b0fc1a4434d4ff1f14"><code>4a616b6</code></a>
docs: a few more updates to prepare for 26.2 (<a
href="https://redirect.github.com/pypa/packaging/issues/1176">#1176</a>)</li>
<li><a
href="https://github.com/pypa/packaging/commit/9de6f44f1e82d4595edf3aad1c4f6f98c85935a0"><code>9de6f44</code></a>
ci: use native uv integration in rtd (<a
href="https://redirect.github.com/pypa/packaging/issues/1175">#1175</a>)</li>
<li><a
href="https://github.com/pypa/packaging/commit/bc76e14debd1a2799d1ca8f9d9c9823f35bfa466"><code>bc76e14</code></a>
chore: update changelog for 26.2 (<a
href="https://redirect.github.com/pypa/packaging/issues/1161">#1161</a>)</li>
<li><a
href="https://github.com/pypa/packaging/commit/3f00091c08f0aa830e33ed7db00f16f11c8ac97f"><code>3f00091</code></a>
tests: add a pickle check (<a
href="https://redirect.github.com/pypa/packaging/issues/1174">#1174</a>)</li>
<li><a
href="https://github.com/pypa/packaging/commit/48a8a069805291186522de3eff73ea80a8ca96ad"><code>48a8a06</code></a>
fix: make Requirements/Markers pickle-safe (<a
href="https://redirect.github.com/pypa/packaging/issues/1171">#1171</a>)</li>
<li><a
href="https://github.com/pypa/packaging/commit/823b44ed1f904084a77ae3adf0ef130af6365f84"><code>823b44e</code></a>
fix: make Tags pickle-safe (<a
href="https://redirect.github.com/pypa/packaging/issues/1170">#1170</a>)</li>
<li><a
href="https://github.com/pypa/packaging/commit/4bed32d920ca7211dd65fdf0a1ee06376e9c4733"><code>4bed32d</code></a>
fix: make Specifier / SpecifierSet pickle-safe (<a
href="https://redirect.github.com/pypa/packaging/issues/1168">#1168</a>)</li>
<li><a
href="https://github.com/pypa/packaging/commit/963118e37caae97bc8b72f72956c7fb4ca9857ec"><code>963118e</code></a>
fix: re-export ExceptionGroup for now (<a
href="https://redirect.github.com/pypa/packaging/issues/1164">#1164</a>)</li>
<li><a
href="https://github.com/pypa/packaging/commit/66e34a80256c96dea11da143682950c84b8133bb"><code>66e34a8</code></a>
docs(specifiers): add is_unsatisfiable() usage example (<a
href="https://redirect.github.com/pypa/packaging/issues/1166">#1166</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/packaging/compare/26.1...26.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `pip` from 26.0 to 26.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's
changelog</a>.</em></p>
<blockquote>
<h1>26.1 (2026-04-26)</h1>
<h2>Deprecations and Removals</h2>
<ul>
<li>Drop support for Python 3.9.
(<code>[#13795](pypa/pip#13795)
<https://github.com/pypa/pip/issues/13795></code>_)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Add experimental support to read requirements from standardized
pylock.toml files (<code>-r pylock.toml</code>).
(<code>[#13876](pypa/pip#13876)
<https://github.com/pypa/pip/issues/13876></code>_)</li>
<li>Allow <code>--uploaded-prior-to</code> to accept a duration in days
(e.g., <code>P3D</code> for 3 days ago).
(<code>[#13674](pypa/pip#13674)
<https://github.com/pypa/pip/issues/13674></code>_)</li>
</ul>
<h2>Enhancements</h2>
<ul>
<li>Speed up dependency resolution when there are complex conflicts.
(<code>[#13859](pypa/pip#13859)
<https://github.com/pypa/pip/issues/13859></code>_)</li>
<li>Reduce memory usage when resolving large dependency trees.
(<code>[#13843](pypa/pip#13843)
<https://github.com/pypa/pip/issues/13843></code>_)</li>
<li>Emit a deprecation warning when pip imports an unexpected module
after
installation of a distribution has started.
(<code>[#13912](pypa/pip#13912)
<https://github.com/pypa/pip/issues/13912></code>_)</li>
<li>Allow URL constraints to apply to requirements with extras.
(<code>[#12018](pypa/pip#12018)
<https://github.com/pypa/pip/issues/12018></code>_)</li>
<li>Allow unpinned requirements to use hashes from constraints.
Constraints
like <code>{name}=={version} --hash=...</code> feeds into hash
verification for
a corresponding requirement.
(<code>[#9243](pypa/pip#9243)
<https://github.com/pypa/pip/issues/9243></code>_)</li>
<li>Improve conflict reports that involve direct URLs.
(<code>[#13932](pypa/pip#13932)
<https://github.com/pypa/pip/issues/13932></code>_)</li>
<li>Show all errors instead of first error for faulty
<code>dependency_groups</code> definitions.
(<code>[#13917](pypa/pip#13917)
<https://github.com/pypa/pip/issues/13917></code>_)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Fix recovery hint for missing RECORD file to use
<code>--ignore-installed</code>
instead of <code>--force-reinstall</code>.
(<code>[#12645](pypa/pip#12645)
<https://github.com/pypa/pip/issues/12645></code>_)</li>
<li>Fix misleading error message when a constraint file cannot be
opened. (<code>[#13226](pypa/pip#13226)
<https://github.com/pypa/pip/issues/13226></code>_)</li>
<li>Show the filename rather than the full URL when downloading files
from non-PyPI indexes in non-verbose mode.
(<code>[#13494](pypa/pip#13494)
<https://github.com/pypa/pip/issues/13494></code>_)</li>
<li>Remove the adjacent <code>__pycache__</code> directory when a .py
file is removed.
(<code>[#13725](pypa/pip#13725)
<https://github.com/pypa/pip/issues/13725></code>_)</li>
<li>Force UTF-8 encoding for :pep:<code>723</code> metadata.
(<code>[#13861](pypa/pip#13861)
<https://github.com/pypa/pip/issues/13861></code>_)</li>
<li>Minor performance improvement when filtering candidates during
resolution. (<code>[#13916](pypa/pip#13916)
<https://github.com/pypa/pip/issues/13916></code>_)</li>
<li>Fix a hang on Windows when stdout is closed during verbose output.
(<code>[#13927](pypa/pip#13927)
<https://github.com/pypa/pip/issues/13927></code>_)</li>
<li>Common path prefixes are determined by path segment, not character
by character. (<code>[#13847](pypa/pip#13847)
<https://github.com/pypa/pip/issues/13847></code>_)</li>
<li>Fix installing <code>.tar.gz</code> source distributions that look
like a zip file.
(<code>[#13867](pypa/pip#13867)
<https://github.com/pypa/pip/issues/13867></code>_)</li>
</ul>
<h2>Vendored Libraries</h2>
<ul>
<li>Upgrade certifi to 2026.2.25</li>
<li>Upgrade packaging to 26.2</li>
<li>Upgrade requests to 2.33.1</li>
<li>Upgrade tomli to 2.3.1</li>
<li>Upgrade urllib3 to 2.6.3</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/pip/commit/90b2b3e0f7ef75c485155716d904e51654575803"><code>90b2b3e</code></a>
Bump for release</li>
<li><a
href="https://github.com/pypa/pip/commit/193f289a6201f801b23885297332461ac8a65b6b"><code>193f289</code></a>
Update AUTHORS.txt</li>
<li><a
href="https://github.com/pypa/pip/commit/63c3709071c9596d7f4676502a90a3b06f241772"><code>63c3709</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13876">#13876</a> from
sbidoul/install-from-pylock-reqs-sbi</li>
<li><a
href="https://github.com/pypa/pip/commit/e5fe7023ffe74a5895571eaf57bdd2989018fbf2"><code>e5fe702</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13949">#13949</a> from
pypa/revert-13888-resolver-editable-links</li>
<li><a
href="https://github.com/pypa/pip/commit/122a14a8cd3dae7b3e959641f0b45849d4b21618"><code>122a14a</code></a>
Revert "Allow editable installs to satisfy direct-URL dependencies
(<a
href="https://redirect.github.com/pypa/pip/issues/13888">#13888</a>)"</li>
<li><a
href="https://github.com/pypa/pip/commit/c3352524aae95ae959d4727dda5b5c65752261b3"><code>c335252</code></a>
-r pylock.toml: add pip-wheel -r pylock.toml test</li>
<li><a
href="https://github.com/pypa/pip/commit/ba2fc12b7f386d89e233bdfd49e7b89d1af57ad1"><code>ba2fc12</code></a>
-r pylock.toml: proper error with remote pylock.toml containing
directory ent...</li>
<li><a
href="https://github.com/pypa/pip/commit/747c4ae88837a8bb13946fe9d1b612c162a2e3df"><code>747c4ae</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13948">#13948</a> from
ichard26/reword-news</li>
<li><a
href="https://github.com/pypa/pip/commit/3517841c5e2d92e04dbef52c61a8fa967c059efa"><code>3517841</code></a>
-r pylock: refine filename pylock-ness test</li>
<li><a
href="https://github.com/pypa/pip/commit/2f7ad8caeed4471e63958df6cacba3a66a215588"><code>2f7ad8c</code></a>
-r pylock.toml: fix crash with pip wheel and pip lock</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/pip/compare/26.0...26.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `wheel` from 0.46.2 to 0.47.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.47.0</h2>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without unpacking them (<a
href="https://redirect.github.com/pypa/wheel/issues/639">#639</a>)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains uppercase characters (e.g.
<code>Django-3.2.5.whl</code>) but the <code>.dist-info</code> directory
inside uses normalized lowercase naming (<a
href="https://redirect.github.com/pypa/wheel/issues/411">#411</a>)</li>
</ul>
<h2>0.46.3</h2>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when installed alongside an old version of
setuptools and running the <code>bdist_wheel</code> command (<a
href="https://redirect.github.com/pypa/wheel/issues/676">#676</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](pypa/wheel#639)
<https://github.com/pypa/wheel/issues/639></code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[google#411](pypa/wheel#411)
<https://github.com/pypa/wheel/issues/411></code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676)
<https://github.com/pypa/wheel/issues/676></code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<ul>
<li>Temporarily restored the <code>wheel.macosx_libfile</code> module
(<code>[#659](pypa/wheel#659)
<https://github.com/pypa/wheel/issues/659></code>_)</li>
</ul>
<p><strong>0.46.0 (2025-04-03)</strong></p>
<ul>
<li>Dropped support for Python 3.8</li>
<li>Removed the <code>bdist_wheel</code> setuptools command
implementation and entry point.
The <code>wheel.bdist_wheel</code> module is now just an alias to
<code>setuptools.command.bdist_wheel</code>, emitting a deprecation
warning on import.</li>
<li>Removed vendored <code>packaging</code> in favor of a run-time
dependency on it</li>
<li>Made the <code>wheel.metadata</code> module private (with a
deprecation warning if it's
imported</li>
<li>Made the <code>wheel.cli</code> package private (no deprecation
warning)</li>
<li>Fixed an exception when calling the <code>convert</code> command
with an empty description
field</li>
</ul>
<p><strong>0.45.1 (2024-11-23)</strong></p>
<ul>
<li>Fixed pure Python wheels converted from eggs and wininst files
having the ABI tag in
the file name</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/efd83a750f07a33462ea2eed365fd8dac9e51442"><code>efd83a7</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/bb69216d35588c2a0febc2d9a130727fe6e46ee3"><code>bb69216</code></a>
Reordered the changelog entries</li>
<li><a
href="https://github.com/pypa/wheel/commit/d5a1763ce927618bfa7d82abe334d0d14a93cc37"><code>d5a1763</code></a>
fix(wheelfile): resolve .dist-info path case-insensitively when reading
wheel...</li>
<li><a
href="https://github.com/pypa/wheel/commit/5718957928ece25eb0d1c12023c71dea4fcb5cf9"><code>5718957</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/685">#685</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/625806845ae5756be3cc0f9d44832c29079c0954"><code>6258068</code></a>
chore: log_level is better than log_cli_level (<a
href="https://redirect.github.com/pypa/wheel/issues/684">#684</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/2975debc789682b3a448b134611acc6962a93eb3"><code>2975deb</code></a>
Require tox >= 4.22</li>
<li><a
href="https://github.com/pypa/wheel/commit/47674ba770e5ee72d679b7eb32b558e0c177640d"><code>47674ba</code></a>
chore: add check-sdist to checks (<a
href="https://redirect.github.com/pypa/wheel/issues/681">#681</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/56223f6f8dfa8d3d40923f24dcf159204698d7b6"><code>56223f6</code></a>
<code>__package__</code> → <code>__spec__.parent</code> (<a
href="https://redirect.github.com/pypa/wheel/issues/679">#679</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ce509e02dc3cd1b7b0bdf868482de062b3c21c3"><code>0ce509e</code></a>
Added the wheel info subcommand (<a
href="https://redirect.github.com/pypa/wheel/issues/669">#669</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/39039c0f3446c1ed5ec52621e98bc2bad8178a06"><code>39039c0</code></a>
Improved the index page</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/wheel/compare/0.46.2...0.47.0">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent 59e5775 commit bcb6665
2 files changed
Lines changed: 68 additions & 68 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | 3 | | |
4 | | - | |
| 4 | + | |
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
9 | | - | |
| 9 | + | |
10 | 10 | | |
11 | | - | |
| 11 | + | |
12 | 12 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
11 | 11 | | |
12 | 12 | | |
13 | 13 | | |
14 | | - | |
15 | | - | |
16 | | - | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
17 | 17 | | |
18 | 18 | | |
19 | 19 | | |
| |||
275 | 275 | | |
276 | 276 | | |
277 | 277 | | |
278 | | - | |
279 | | - | |
280 | | - | |
281 | | - | |
282 | | - | |
283 | | - | |
284 | | - | |
285 | | - | |
286 | | - | |
287 | | - | |
288 | | - | |
289 | | - | |
290 | | - | |
291 | | - | |
292 | | - | |
293 | | - | |
294 | | - | |
295 | | - | |
296 | | - | |
297 | | - | |
298 | | - | |
299 | | - | |
300 | | - | |
301 | | - | |
302 | | - | |
303 | | - | |
304 | | - | |
305 | | - | |
306 | | - | |
307 | | - | |
308 | | - | |
309 | | - | |
310 | | - | |
311 | | - | |
312 | | - | |
313 | | - | |
314 | | - | |
315 | | - | |
316 | | - | |
317 | | - | |
318 | | - | |
319 | | - | |
320 | | - | |
321 | | - | |
322 | | - | |
323 | | - | |
324 | | - | |
325 | | - | |
326 | | - | |
327 | | - | |
| 278 | + | |
| 279 | + | |
| 280 | + | |
| 281 | + | |
| 282 | + | |
| 283 | + | |
| 284 | + | |
| 285 | + | |
| 286 | + | |
| 287 | + | |
| 288 | + | |
| 289 | + | |
| 290 | + | |
| 291 | + | |
| 292 | + | |
| 293 | + | |
| 294 | + | |
| 295 | + | |
| 296 | + | |
| 297 | + | |
| 298 | + | |
| 299 | + | |
| 300 | + | |
| 301 | + | |
| 302 | + | |
| 303 | + | |
| 304 | + | |
| 305 | + | |
| 306 | + | |
| 307 | + | |
| 308 | + | |
| 309 | + | |
| 310 | + | |
| 311 | + | |
| 312 | + | |
| 313 | + | |
| 314 | + | |
| 315 | + | |
| 316 | + | |
| 317 | + | |
| 318 | + | |
| 319 | + | |
| 320 | + | |
| 321 | + | |
| 322 | + | |
| 323 | + | |
| 324 | + | |
| 325 | + | |
| 326 | + | |
| 327 | + | |
328 | 328 | | |
329 | 329 | | |
330 | 330 | | |
| |||
511 | 511 | | |
512 | 512 | | |
513 | 513 | | |
514 | | - | |
515 | | - | |
516 | | - | |
| 514 | + | |
| 515 | + | |
| 516 | + | |
517 | 517 | | |
518 | 518 | | |
519 | 519 | | |
| |||
1042 | 1042 | | |
1043 | 1043 | | |
1044 | 1044 | | |
1045 | | - | |
1046 | | - | |
1047 | | - | |
| 1045 | + | |
| 1046 | + | |
| 1047 | + | |
1048 | 1048 | | |
1049 | 1049 | | |
1050 | 1050 | | |
| |||
1150 | 1150 | | |
1151 | 1151 | | |
1152 | 1152 | | |
1153 | | - | |
1154 | | - | |
1155 | | - | |
| 1153 | + | |
| 1154 | + | |
| 1155 | + | |
1156 | 1156 | | |
1157 | 1157 | | |
1158 | 1158 | | |
| |||
1276 | 1276 | | |
1277 | 1277 | | |
1278 | 1278 | | |
1279 | | - | |
1280 | | - | |
1281 | | - | |
| 1279 | + | |
| 1280 | + | |
| 1281 | + | |
1282 | 1282 | | |
1283 | 1283 | | |
1284 | 1284 | | |
| |||
0 commit comments